7 ms·

And yet the adoption rate is through the roof. Seems that to succeed you don’t focus on security till you get caught. None of this will change unless there is

And yet the adoption rate is through the roof. Seems that to succeed you don’t focus on security till you get caught. None of this will change unless there is a shift of liability back onto companies for securing data.

m11a 7y ago
I think it's becoming a pattern that people (users) don't care about what they can't see. And furthermore, people (users) overall don't seem to care about security until something goes wrong. Besides, a layman doesn't understand even the simplest terms in that article, so naturally how are they supposed to care? Many traditional organisations (schools, enterprise, etc) that care for security, in my experience, did so for GDPR compliance and to the extent that they were compliant. A lot of businesses weren't even being malicious, just negligent. So, on the whole, regular users don't seem to care, and since users don't hold businesses accountable for it, businesses don't really care. NB: Users refers to any random person who isn't in the tech industry. Like, probably, your neighbour or the random person walking their dog.
- fock 7y ago
  user's didn't care in the past. The yahoo toolbar lived merrily for years. Then came the hot business of "computer security tools". Nowadays with everything (except Zoom) working in a browser people apparently forgot that their computer still contains relevant data and they still have to think about it (not only about the "hot" cloud). I think in the late PC era, Zoom would have been surely classified as malware by some of the more zealous programs out there and whooops, there goes APT-like userfriendlyness...
poisonborz 7y ago
For the average user, a privacy/security concern is a possible/theoretical issue, missing features a very real, instantenous issue. Slack, Teams & co flat-out ignored calls and screen sharing until now. They were sidelined so-so features. Hell, on Slack you couldn't even see screen sharing from mobile, and you did not even got a notification that another person is sharing. Never mind missing even the most basic annotation features. No wonder Zoom eats all the pies now. Sure, they made a lot of mistakes, but it was a huge landfall on a small(ish) company. That said, if the others top up their game, I'm happy to get rid of an additional app - but that's how market works.
- srg0 7y ago
  I would say that the company I work for doesn't use Slack exactly for this reason. Screen sharing and group calls are not available in the free version, so slack trial didn't went beyond the first three users. Guess what, we're paying for teams and zoom now.
- ScoutOrgo 7y ago
  Just general video/audio performance too. Zoom is the only one I've used where everyone can have an open mic, have noise in the background (or even music), and the whole group can still have a good conversation.
- fsflover 7y ago
  "Sure, they made a lot of mistakes" - is a strong understatement given how they have been treating the users. Just look at the history of posts about Zoom here. Upd: These are not mistakes. They did all that intentionally, fogetting about the security for convenience even when it was beyond reasonable imho. Upd2: Why downvotes? Some recent headlines from Hacker News: - "Zoom rolled their own encryption scheme, transmit keys through servers in China" - "Zoom meetings aren’t end-to-end encrypted, despite marketing" Are you calling these "mistakes"?
- greendave 7y ago
  This sort of dynamic is something I feel the Free Software/Open Source world often misses. Yes, security, openness and ideally freedom are desirable and in some cases essential, but if the software doesn't fundamentally work well at its primary task, for its intended audience, those benefits won't count for a lot. I think Zoom certainly deserves the criticism that they're getting regarding security. But until the alternatives figure out things on the functionality front, I don't think that's a sufficient reason to kick Zoom to the curb.
organsnyder 7y ago
They're succeeding because of their security issues. Look at the problems they've had over the past month: - "Zoombombing" is a thing because the default meeting configuration didn't require a password, making it easier for attendees—legitimate or not—to join. - Issues with the installer were in part caused by shady workarounds they took to reduce friction during the installation. And yet, they're doing just fine with their "UX first, security later" approach. So I guess I'm underscoring your point: we absolutely need more consumer protection. Side-note: I wonder if Zoom is getting into trouble in Europe over any of this?
- rjsw 7y ago
  > Side-note: I wonder if Zoom is getting into trouble in Europe over any of this? Some European organizations are banning it from business computers. I only use it for semi-public discussions, and run it on a Windows 10 laptop that isn't used for anything else, so I'm not that bothered by the security issues.
  - 35803288 7y ago
    They might, but it will be some time before privacy authorities build a case against Zoom and start fining them. In the meanwhile, imho they are under so much pressure to behave that in the next few months might really make some progress in this field. I mean, right now Zoom is the most independently "audited" video conferencing app in the world and many newspapers and state attorneys are investigating [1]. I trust the power of the press. [1] https://www.nytimes.com/2020/03/30/technology/new-york-attorney-general-zoom-privacy.html https://www.nytimes.com/2020/03/30/technology/new-york-attor...
- earthboundkid 7y ago
  "Zoombombing" is a thing because the ID space is ridiculously small. It's 8 digits! Just pump it up to UUID size and encode it as Crockford Base32 + checksum. Then you don't need a password because the ID space is too big to guess. We all learned this back in the days of link shortners, but Zoom somehow didn't?
softwaredoug 7y ago
I think this isn’t quite the right take. Security’s priority has become quite a lot higher given we now have to run our lives, governments, militaries and entire companies online. A few months ago this wasn’t true, teleconferencing was a sideshow to the main event, with many interactions still happening in real life. Now if I can’t have a private conversation online it’s much more important to me. A month or two ago it was important, but probably not as much as usability and reliability
m3kw9 7y ago
Sure use an alternative where no one does free vetting. Not saying Zoom is ok but just saying stuff like that won’t help anyone
Spooky23 7y ago
Security is all about tradeoffs - risk/reward. Security bloggers are all about attention - shiny thing. That's why there's a semi-annual story that gets some traction with a headline like "Experts from FooCorp warn that the honeymoon is over, viruses have arrived on MacOS!" Zoom is the new Apple for this shit. Zoom has lots of issues, but the pile-on is just dumb. Everything has issues. Do you use a phone? Landlines are not encrypted, mobile is encrypted with defective security, and carriers have access to all metadata, all data, and provide CALEA access as a service. So yeah, there's a risk that your sales call, or 5th grade english class, or other meeting could be compromised by some malicious third party. How does the probability/impact of that stack up against the probability that your salesman or 5th grader's grandmother will be infected and die from exposure? I've worked and architected systems for people with very high confidentiality requirements. Guess what? They don't use internet-based remote collaboration systems to remotely collaborate. The only common system that comes to mind that you might be able to use in these scenarios is an on-premise version of Webex, assuming it still exists!
- user5994461 7y ago
  To be fair, it is true this year that there is more malware on MacOS than on Windows.
  - LeoTinnitus 7y ago
    What? That's interesting to me. Is Apples desktop OS market share that much larger now?
- exolymph 7y ago
  > Zoom has lots of issues, but the pile-on is just dumb. It's not dumb, it's a response to incentives! As you noted in the second paragraph! Researchers want attention, which is only natural.
- jupp0r 7y ago
  > Zoom has lots of issues, but the pile-on is just dumb. Everything has issues. Why is reacting to known security vulnerabilities in the software you distribute so controversial? It's not rocket science to keep your openssl dependency up to date. I agree that there will always be unknown vulnerabilities that they introduce themselves, but if they knowingly ignore public vulnerabilities it's just negligence imho.

m11a 7y ago

I think it's becoming a pattern that people (users) don't care about what they can't see. And furthermore, people (users) overall don't seem to care about security until something goes wrong. Besides, a layman doesn't understand even the simplest terms in that article, so naturally how are they supposed to care? Many traditional organisations (schools, enterprise, etc) that care for security, in my experience, did so for GDPR compliance and to the extent that they were compliant. A lot of businesses weren't even being malicious, just negligent. So, on the whole, regular users don't seem to care, and since users don't hold businesses accountable for it, businesses don't really care. NB: Users refers to any random person who isn't in the tech industry. Like, probably, your neighbour or the random person walking their dog.

fock 7y ago
user's didn't care in the past. The yahoo toolbar lived merrily for years. Then came the hot business of "computer security tools". Nowadays with everything (except Zoom) working in a browser people apparently forgot that their computer still contains relevant data and they still have to think about it (not only about the "hot" cloud). I think in the late PC era, Zoom would have been surely classified as malware by some of the more zealous programs out there and whooops, there goes APT-like userfriendlyness...

poisonborz 7y ago

For the average user, a privacy/security concern is a possible/theoretical issue, missing features a very real, instantenous issue. Slack, Teams & co flat-out ignored calls and screen sharing until now. They were sidelined so-so features. Hell, on Slack you couldn't even see screen sharing from mobile, and you did not even got a notification that another person is sharing. Never mind missing even the most basic annotation features. No wonder Zoom eats all the pies now. Sure, they made a lot of mistakes, but it was a huge landfall on a small(ish) company. That said, if the others top up their game, I'm happy to get rid of an additional app - but that's how market works.

srg0 7y ago
I would say that the company I work for doesn't use Slack exactly for this reason. Screen sharing and group calls are not available in the free version, so slack trial didn't went beyond the first three users. Guess what, we're paying for teams and zoom now.
ScoutOrgo 7y ago
Just general video/audio performance too. Zoom is the only one I've used where everyone can have an open mic, have noise in the background (or even music), and the whole group can still have a good conversation.
fsflover 7y ago
"Sure, they made a lot of mistakes" - is a strong understatement given how they have been treating the users. Just look at the history of posts about Zoom here. Upd: These are not mistakes. They did all that intentionally, fogetting about the security for convenience even when it was beyond reasonable imho. Upd2: Why downvotes? Some recent headlines from Hacker News: - "Zoom rolled their own encryption scheme, transmit keys through servers in China" - "Zoom meetings aren’t end-to-end encrypted, despite marketing" Are you calling these "mistakes"?
greendave 7y ago
This sort of dynamic is something I feel the Free Software/Open Source world often misses. Yes, security, openness and ideally freedom are desirable and in some cases essential, but if the software doesn't fundamentally work well at its primary task, for its intended audience, those benefits won't count for a lot. I think Zoom certainly deserves the criticism that they're getting regarding security. But until the alternatives figure out things on the functionality front, I don't think that's a sufficient reason to kick Zoom to the curb.

organsnyder 7y ago

They're succeeding because of their security issues. Look at the problems they've had over the past month: - "Zoombombing" is a thing because the default meeting configuration didn't require a password, making it easier for attendees—legitimate or not—to join. - Issues with the installer were in part caused by shady workarounds they took to reduce friction during the installation. And yet, they're doing just fine with their "UX first, security later" approach. So I guess I'm underscoring your point: we absolutely need more consumer protection. Side-note: I wonder if Zoom is getting into trouble in Europe over any of this?

rjsw 7y ago
> Side-note: I wonder if Zoom is getting into trouble in Europe over any of this? Some European organizations are banning it from business computers. I only use it for semi-public discussions, and run it on a Windows 10 laptop that isn't used for anything else, so I'm not that bothered by the security issues.
- 35803288 7y ago
  They might, but it will be some time before privacy authorities build a case against Zoom and start fining them. In the meanwhile, imho they are under so much pressure to behave that in the next few months might really make some progress in this field. I mean, right now Zoom is the most independently "audited" video conferencing app in the world and many newspapers and state attorneys are investigating [1]. I trust the power of the press. [1] https://www.nytimes.com/2020/03/30/technology/new-york-attorney-general-zoom-privacy.html https://www.nytimes.com/2020/03/30/technology/new-york-attor...
earthboundkid 7y ago
"Zoombombing" is a thing because the ID space is ridiculously small. It's 8 digits! Just pump it up to UUID size and encode it as Crockford Base32 + checksum. Then you don't need a password because the ID space is too big to guess. We all learned this back in the days of link shortners, but Zoom somehow didn't?

softwaredoug 7y ago

I think this isn’t quite the right take. Security’s priority has become quite a lot higher given we now have to run our lives, governments, militaries and entire companies online. A few months ago this wasn’t true, teleconferencing was a sideshow to the main event, with many interactions still happening in real life. Now if I can’t have a private conversation online it’s much more important to me. A month or two ago it was important, but probably not as much as usability and reliability

m3kw9 7y ago

Sure use an alternative where no one does free vetting. Not saying Zoom is ok but just saying stuff like that won’t help anyone

Spooky23 7y ago

Security is all about tradeoffs - risk/reward. Security bloggers are all about attention - shiny thing. That's why there's a semi-annual story that gets some traction with a headline like "Experts from FooCorp warn that the honeymoon is over, viruses have arrived on MacOS!" Zoom is the new Apple for this shit. Zoom has lots of issues, but the pile-on is just dumb. Everything has issues. Do you use a phone? Landlines are not encrypted, mobile is encrypted with defective security, and carriers have access to all metadata, all data, and provide CALEA access as a service. So yeah, there's a risk that your sales call, or 5th grade english class, or other meeting could be compromised by some malicious third party. How does the probability/impact of that stack up against the probability that your salesman or 5th grader's grandmother will be infected and die from exposure? I've worked and architected systems for people with very high confidentiality requirements. Guess what? They don't use internet-based remote collaboration systems to remotely collaborate. The only common system that comes to mind that you might be able to use in these scenarios is an on-premise version of Webex, assuming it still exists!

user5994461 7y ago
To be fair, it is true this year that there is more malware on MacOS than on Windows.
- LeoTinnitus 7y ago
  What? That's interesting to me. Is Apples desktop OS market share that much larger now?
exolymph 7y ago
> Zoom has lots of issues, but the pile-on is just dumb. It's not dumb, it's a response to incentives! As you noted in the second paragraph! Researchers want attention, which is only natural.
jupp0r 7y ago
> Zoom has lots of issues, but the pile-on is just dumb. Everything has issues. Why is reacting to known security vulnerabilities in the software you distribute so controversial? It's not rocket science to keep your openssl dependency up to date. I agree that there will always be unknown vulnerabilities that they introduce themselves, but if they knowingly ignore public vulnerabilities it's just negligence imho.